What is the CVSS score of CVE-2025-52772?

CVE-2025-52772 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Adnan Haque are affected by CVE-2025-52772?

A Cross-Site Request Forgery vulnerability in Virtual Moderator version 1.4 and earlier allows attackers to perform unauthorized actions on behalf of authenticated users.

How to fix or mitigate CVE-2025-52772?

Within 24 hours: Identify all instances of Virtual Moderator in use and document affected systems. Within 7 days: Implement compensating controls including Web Application Firewall rules to detect/block CSRF patterns, restrict plugin access to trusted networks only, and disable the plugin if business operations permit. Within 30 days: Monitor vendor communications for patch availability and establish upgrade procedures; consider alternative moderation solutions if patch timeline is unclear.

Adnan Haque CVE-2025-52772

EUVD-2025-28458 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 audit@patchstack.com

CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-28458

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

CVE Published

Jun 20, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator: from n/a through 1.4.

AnalysisAI

CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.

Technical ContextAI

The vulnerability exists in the Virtual Moderator plugin (CPE: likely a11n/Virtual Moderator or similar WordPress/web plugin identifier). The root cause is CWE-352 (Cross-Site Request Forgery), which allows attackers to forge requests from authenticated users without their knowledge. The vulnerability is compounded by a secondary XSS impact, suggesting insufficient input validation and CSRF token verification. The plugin likely lacks proper nonce validation and sanitization of user inputs, allowing attackers to chain CSRF attacks with XSS payloads. This is typical in web plugins where state-changing operations (moderation actions, settings changes) are protected by insufficient anti-CSRF mechanisms and output encoding is inadequate.

RemediationAI

Upgrade Virtual Moderator to version 1.5 or later (assumed; verify with plugin repository); priority: Immediate Workaround: Disable the Virtual Moderator plugin if version 1.4 or earlier and patch is unavailable; use alternative moderation solutions Mitigation: Implement Web Application Firewall (WAF) rules to detect and block CSRF token manipulation and XSS payloads targeting moderation endpoints Mitigation: Enforce Content Security Policy (CSP) headers to restrict script execution and form submissions Mitigation: Audit user roles and permissions; limit moderation privileges to trusted administrators only Developer Fix: Implement WordPress nonce verification (wp_verify_nonce) on all state-changing operations; sanitize and escape all user inputs; validate referrer headers